CVE-2026-97946
Received Received - Intake

Memory Leak in Linux Kernel PCI Device Handling

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix PCI device reference counting in amd_smn_init() The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the search is complete. Use the __free() cleanup macro to ensure the refcount is decremented when the temporary pointer goes out of scope. Additionally, increment the refcount when caching a root pointer. This ensures the in-use refcount is separate from the temporary search refcounting. Finally, drop the redundant "root = NULL" before the second search loop. The pci_get_class() iterator always decrements the refcount of its "from" argument, so the first loop can only fall through with "root" already NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97946
EUVD
EUVD-2026-86800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect reference counting in the amd_smn_init() function. A temporary pointer used during device search was not properly cleaned up, leading to incorrect refcount management. The fix ensures refcounts are decremented when the temporary pointer goes out of scope and incremented when caching a root pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's x86/amd_node subsystem and involves PCI device reference counting. Detection requires checking kernel logs for related errors or kernel crashes during PCI device initialization. Commands like dmesg or journalctl -k may show errors during system boot or PCI device probing.

Impact Analysis

This vulnerability could lead to memory leaks or use-after-free issues in the Linux kernel, potentially causing system instability, crashes, or privilege escalation. Systems using affected kernel versions may be vulnerable to memory corruption.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel patches from your distribution vendor and apply them promptly. No additional configuration changes are required as the fix is integrated into the kernel code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97946. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart